Spotweb EUVD-2026-96341

Exploitation requires that the target Spotweb instance has the runcommand NZB handler integration enabled/configured - this is the specific feature that passes the spot title to exec(). The attacker needs no Spotweb authentication (spots are self-signed and posted over Usenet, PR:N), but exploitation is gated by passive victim interaction: a Spotweb user must download/process the malicious spot through that handler for the injected $SPOTTITLE to reach exec(). The AT:P and AC:H metrics reflect these preconditions (handler configured, victim action, successful propagation of the crafted spot). Code executes with the privileges of the Spotweb PHP process, not necessarily root. Instances without the runcommand integration configured are not exploitable via this path.

This is a genuine but conditional risk, not a drop-everything emergency. The CVSS 4.0 base score of 7.7 (High) reflects full technical impact (VC:H/VI:H/VA:H - arbitrary command execution as the Spotweb PHP process) reachable over the network without authentication (AV:N/PR:N), which is why it scores high. However, the same vector encodes significant real-world friction: AC:H (high attack complexity), AT:P (a specific attack requirement/precondition), and UI:P (passive user interaction) mean exploitation is not fire-and-forget - an attacker posts a self-signed spot with a malicious title to Usenet and must then wait for a victim Spotweb user to actually download/process that spot via the runcommand NZB handler. Publicly available exploit code exists (POC write-up on hackmd and a VulnCheck advisory), which raises practical risk, but there is no CISA KEV listing and no EPSS value provided, so there is no evidence of active or widespread exploitation - consistent with the UI/precondition gating that makes mass automated attacks impractical. SSVC-style reading: exploitation is 'POC', automatable is effectively 'no' (requires per-victim interaction), technical impact 'total'. Net: credible, confirmed-exploitable weakness in a niche product, warranting prompt patching for anyone running Spotweb with the runcommand integration, but lower urgency than an unauthenticated zero-click RCE.

An attacker publishes a self-signed spot to a Usenet newsgroup with shell metacharacters embedded in the spot title (e.g. a backtick or $() payload). When a Spotweb user who has the runcommand NZB handler configured downloads that spot, the unescaped title is substituted into $SPOTTITLE and passed to exec(), running the attacker's command as the Spotweb PHP process. A public proof-of-concept write-up detailing the injection already exists.